{"id":86341,"date":"2026-01-21T16:01:03","date_gmt":"2026-01-21T16:01:03","guid":{"rendered":""},"modified":"-0001-11-30T00:00:00","modified_gmt":"-0001-11-30T00:00:00","slug":"cve-2025-24007-weak-password-obfuscation-vulnerability-in-sirius-safety-systems","status":"publish","type":"post","link":"https:\/\/www.ameeba.com\/blog\/cve-2025-24007-weak-password-obfuscation-vulnerability-in-sirius-safety-systems\/","title":{"rendered":"CVE-2025-24007: Weak Password Obfuscation Vulnerability in SIRIUS Safety Systems<\/strong>"},"content":{"rendered":"

Overview<\/strong><\/p>\n

This report provides a detailed analysis of a serious vulnerability identified in SIRIUS 3RK3 Modular Safety System (MSS) and SIRIUS Safety Relays 3SK2 across all versions. The vulnerability stems from a weak password obfuscation mechanism, making it possible for attackers with network access to retrieve and de-obfuscate the safety password. Given the potential for system compromise or data leakage, addressing this vulnerability is critical.<\/p>\n

Vulnerability Summary<\/strong><\/p>\n

CVE ID: CVE-2025-24007
\nSeverity: High (7.5 CVSS Score)
\nAttack Vector: Network
\nPrivileges Required: None
\nUser Interaction: None
\nImpact: System compromise or data leakage<\/p>\n

Affected Products<\/strong><\/p>\n

Product | Affected Versions<\/p>\n

SIRIUS 3RK3 Modular Safety System (MSS) | All versions
\nSIRIUS Safety Relays 3SK2 | All versions<\/p>\n

How the Exploit Works<\/strong><\/p>\n

The exploit leverages the weak password obfuscation mechanism present in the SIRIUS safety systems. An attacker with network access can retrieve the obfuscated safety password. Given the weakness in the obfuscation, they can then de-obfuscate this password. With the safety password in hand, the attacker can then bypass protection mechanisms against inadvertent operating errors, potentially causing system compromise or data leakage.<\/p>\n

Conceptual Example Code<\/strong><\/p>\n

Below is a conceptual representation of how an attacker might exploit this vulnerability:<\/p>\n

GET \/retrieve\/password HTTP\/1.1\nHost: target.sirius.com\nAccept: application\/json<\/code><\/pre>\n
In the above pseudocode, the attacker sends a simple HTTP GET request to a hypothetical endpoint that retrieves the obfuscated safety password.<\/p>\n","protected":false},"excerpt":{"rendered":"
Overview This report provides a detailed analysis of a serious vulnerability identified in SIRIUS 3RK3 Modular Safety System (MSS) and SIRIUS Safety Relays 3SK2 across all versions. The vulnerability stems from a weak password obfuscation mechanism, making it possible for attackers with network access to retrieve and de-obfuscate the safety password. Given the potential for […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"footnotes":""},"categories":[],"tags":[],"vendor":[],"product":[],"attack_vector":[],"asset_type":[],"severity":[],"exploit_status":[],"class_list":["post-86341","post","type-post","status-publish","format-standard","hentry"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t